diff --git a/developer_manual/release_notes/critical_changes.rst b/developer_manual/release_notes/critical_changes.rst
index 9e5a552bfd5..098e3e83124 100644
--- a/developer_manual/release_notes/critical_changes.rst
+++ b/developer_manual/release_notes/critical_changes.rst
@@ -157,3 +157,11 @@ Other removed back-end APIs
 - All the deprecated methods of ``\OCP\Calendar\Resource\IManager`` and ``\OCP\Calendar\Room\IManager`` were deprecated since Nextcloud 24 and were removed without replacement.
 - The ``\OCP\Collaboration\AutoComplete\AutoCompleteEvent`` event was deprecated since Nextcloud 28 and was removed with ``OCP\Collaboration\AutoComplete\AutoCompleteFilterEvent`` as replacement;
 - ``\OCP\Files\IRootFolder`` does not publicly implement the deprecated and private ``OC\Hooks\Emitter`` interface anymore. The private implementations still do, but support might be removed at any moment without notice. The replacement for the hooks provided by ``IRootFolder`` are the node events defined in the ``OCP\Files\Events\Node`` namespace.
+
+Signed cloud federation notifications
+-------------------------------------
+
+Apps with a custom ``\OCP\Federation\ICloudFederationProvider`` that receives notifications must also implement
+``\OCP\Federation\ISignedCloudFederationProvider``. The implementation must resolve the remote federation ID from the
+notification's shared secret and trusted data stored when the share was accepted. Return an empty string when the
+secret does not identify exactly one remote origin.